engine.DaemonGuard

A tmux id is unique within one daemon and reissued by the next: kill-server and a restart give a new daemon the same socket, and it numbers its panes from %0 again. A handle captured before the restart therefore names something that exists, belongs to somebody else, and answers to the same command.

Checking first and sending second does not close that: the daemon can change between the two. if-shell -F does, because it is not a shell — tmux expands the format inside its command queue and cmdq_insert_afters the guarded command into the same queue, so nothing runs in between. The condition is pid and start_time together, since pids are reused.

The refusal has to be visible. tmux answers a false condition with no output and status 0, which is indistinguishable from a command that printed nothing, so the else branch is a freshly named unknown command. A 128-bit suffix makes matching a pre-existing command alias a guess, and the exact diagnostic distinguishes the refusal from the guarded command failing. The guarded command keeps its own stdout and stderr either way.